Both these artifacts are the same ("Java Streaming API for XML", JSR-173) . The API is included in the JDK since 1.6, so we really don't need to bundle them. Their license information is inconsistent in pom.xml (Apache for the former, GPL+CDDL for the latter) and partly incompatible for us (because of GPL) They're currently coming from JaxB (through google-sitemap module) and Tika, respectively. We might have to add them to the "banned dependencies" in our parent poms.